This is an automated email from the ASF dual-hosted git repository.
LuciferYang pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/spark.git
The following commit(s) were added to refs/heads/master by this push:
new 019ad6bb82bd [SPARK-59893][INFRA][TEST] Fix npm vulnerabilities in dev
and ui-test
019ad6bb82bd is described below
commit 019ad6bb82bd580ed2ee9f4a45a9aa46a8773fb4
Author: YangJie <[email protected]>
AuthorDate: Thu Oct 1 13:55:32 2026 +0800
[SPARK-59893][INFRA][TEST] Fix npm vulnerabilities in dev and ui-test
### What changes were proposed in this pull request?
This regenerates the two `package-lock.json` files with `npm audit fix
--package-lock-only`, moving `brace-expansion` past the advisory range in both
npm projects. Only the lockfiles change; no `package.json` and no direct
dependency is touched.
Version moves:
- `dev`: `brace-expansion` 1.1.18 -> 1.1.21, `fast-uri` 3.1.7 -> 3.1.8.
- `ui-test`: `brace-expansion` 1.1.18 -> 1.1.21 (under `test-exclude`),
2.1.4 -> 2.1.7 (under `jest/reporters`, `jest-config`, `jest-runtime`), and
5.0.9 -> 5.0.12 (top level).
### Why are the changes needed?
`brace-expansion`
[GHSA-q2hr-2g5m-vwhr](https://github.com/advisories/GHSA-q2hr-2g5m-vwhr):
quadratic-time expansion of the `{a},b}` rewrite causes a CPU denial of
service. `npm audit` also flags two recursion advisories that the same patched
releases close:
[GHSA-qhr7-859c-m2p7](https://github.com/advisories/GHSA-qhr7-859c-m2p7) (stack
exhaustion on nested brace groups) and
[GHSA-6j4f-fj2g-mc7p](https://github.com/advisories/GHSA-6j4f-fj2g-mc7p) (stack
exhaustion in `parseCommaParts` [...]
This addresses https://github.com/apache/spark/security/dependabot/246,
https://github.com/apache/spark/security/dependabot/254,
https://github.com/apache/spark/security/dependabot/255 and
https://github.com/apache/spark/security/dependabot/256.
The `dev` run also carries `fast-uri` 3.1.7 -> 3.1.8, which clears
[GHSA-hrr3-gc8f-f4qj](https://github.com/advisories/GHSA-hrr3-gc8f-f4qj)
(inconsistent host case normalization via percent-encoded octets, moderate) so
the audit comes back clean.
These are dev/test-only dependencies, but it is worth keeping the audit
clean.
### Does this PR introduce _any_ user-facing change?
No.
### How was this patch tested?
`npm audit` reports 0 vulnerabilities in both projects afterward, and `npm
ci` reproduces both lockfiles unmodified. GitHub Actions does not run `npm
audit` or `npm ci`.
### Was this patch authored or co-authored using generative AI tooling?
Generated-by: Claude Opus 4.8
Closes #59156 from LuciferYang/SPARK-59893.
Lead-authored-by: YangJie <[email protected]>
Co-authored-by: reviewer <reviewer@local>
Signed-off-by: yangjie01 <[email protected]>
---
dev/package-lock.json | 24 ++++++++++++------------
ui-test/package-lock.json | 30 +++++++++++++++---------------
2 files changed, 27 insertions(+), 27 deletions(-)
diff --git a/dev/package-lock.json b/dev/package-lock.json
index 5d3ec9ee3bd9..5233285de0fd 100644
--- a/dev/package-lock.json
+++ b/dev/package-lock.json
@@ -237,9 +237,9 @@
"dev": true
},
"node_modules/brace-expansion": {
- "version": "1.1.18",
- "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz";,
- "integrity":
"sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
+ "version": "1.1.21",
+ "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz";,
+ "integrity":
"sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
"dev": true,
"license": "MIT",
"dependencies": {
@@ -593,9 +593,9 @@
"dev": true
},
"node_modules/fast-uri": {
- "version": "3.1.7",
- "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.7.tgz";,
- "integrity":
"sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==",
+ "version": "3.1.8",
+ "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz";,
+ "integrity":
"sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==",
"dev": true,
"funding": [
{
@@ -1416,9 +1416,9 @@
"dev": true
},
"brace-expansion": {
- "version": "1.1.18",
- "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz";,
- "integrity":
"sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
+ "version": "1.1.21",
+ "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz";,
+ "integrity":
"sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
"dev": true,
"requires": {
"balanced-match": "^1.0.0",
@@ -1692,9 +1692,9 @@
"dev": true
},
"fast-uri": {
- "version": "3.1.7",
- "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.7.tgz";,
- "integrity":
"sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==",
+ "version": "3.1.8",
+ "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz";,
+ "integrity":
"sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==",
"dev": true
},
"file-entry-cache": {
diff --git a/ui-test/package-lock.json b/ui-test/package-lock.json
index a68dc54991d7..d083cb692134 100644
--- a/ui-test/package-lock.json
+++ b/ui-test/package-lock.json
@@ -1058,9 +1058,9 @@
}
},
"node_modules/@jest/reporters/node_modules/brace-expansion": {
- "version": "2.1.4",
- "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz";,
- "integrity":
"sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==",
+ "version": "2.1.7",
+ "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.7.tgz";,
+ "integrity":
"sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==",
"dev": true,
"license": "MIT",
"dependencies": {
@@ -2049,9 +2049,9 @@
}
},
"node_modules/brace-expansion": {
- "version": "5.0.9",
- "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz";,
- "integrity":
"sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
+ "version": "5.0.12",
+ "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz";,
+ "integrity":
"sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==",
"dev": true,
"license": "MIT",
"dependencies": {
@@ -3131,9 +3131,9 @@
}
},
"node_modules/jest-config/node_modules/brace-expansion": {
- "version": "2.1.4",
- "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz";,
- "integrity":
"sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==",
+ "version": "2.1.7",
+ "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.7.tgz";,
+ "integrity":
"sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==",
"dev": true,
"license": "MIT",
"dependencies": {
@@ -3539,9 +3539,9 @@
}
},
"node_modules/jest-runtime/node_modules/brace-expansion": {
- "version": "2.1.4",
- "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz";,
- "integrity":
"sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==",
+ "version": "2.1.7",
+ "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.7.tgz";,
+ "integrity":
"sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==",
"dev": true,
"license": "MIT",
"dependencies": {
@@ -4669,9 +4669,9 @@
}
},
"node_modules/test-exclude/node_modules/brace-expansion": {
- "version": "1.1.18",
- "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz";,
- "integrity":
"sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
+ "version": "1.1.21",
+ "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz";,
+ "integrity":
"sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
"dev": true,
"license": "MIT",
"dependencies": {
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
